UniPass is a local-first, zero-knowledge password manager. By design we do everything we can to minimize the data we can see — because data we can see is data that can leak.
- Local-first: vault data is encrypted on your device with XChaCha20-Poly1305 before it ever leaves.
- Your account, not your vault: UniPass requires an account; our server keeps only what is needed to sign you in. With Free Local, vault records stay on the current Mac, iPhone or iPad.
- Sync is end-to-end encrypted: cloud sync runs only with an active trial or subscription, and uploads only ciphertext. We have no keys and cannot decrypt it.
- Zero telemetry: no automatic uploads of usage analytics or crash reports, and no behavioral tracking.
- We don't sell data, run ads, or profile you.
What we collect
Your UniPass account
Using UniPass requires an account. When you create one or sign in, our server stores your account email; an authentication hash derived on your device from your master password with Argon2id (irreversible; the server keeps only a SHA-256 digest of it); your vault key, encrypted with a key that only your master password and Secret Key can derive; the key-derivation parameters; your account's public keys and the matching private keys in encrypted form; and each signed-in device's name, type and last sync time. If you turn on two-step verification, the server also stores your authenticator (TOTP) secret, encrypted with a server-held key, and the public credentials of any account passkeys. Your master password, Secret Key and vault contents are never part of this data.
Free Local (no trial or subscription)
Beyond the account data above, nothing from your vault is sent to UniPass. Vault records, folders and attachments stay on your device, and the server rejects vault uploads from accounts without cloud access. The apps can still make the favicon requests described below; the Mac app also offers user-initiated breach checks; those services receive your network IP as part of an ordinary HTTPS connection.
With cloud sync (trial, Personal or existing Beta access)
Cloud sync runs automatically while your account has an active trial, a Personal subscription or existing Beta cloud access. In addition to the account data above, only the following is uploaded:
| Category | Uploaded? | Notes |
|---|---|---|
| Master password | No | Never leaves the device; the server only sees an Argon2id-derived auth hash (irreversible). |
| Vault records (logins, notes, cards, etc.) | Ciphertext only | Opaque XChaCha20-Poly1305 blobs; the server has no key to decrypt them. |
| Folders and attachments | Ciphertext only | Folder names, attachment contents and attachment file names are encrypted. The server sees attachment sizes and an optional file-type hint (for example image/png). |
| Secret Key | No | Generated at sign-up, stored in the device Keychain, and never sent in plaintext. |
| Recovery Code | No | The code is displayed once and never uploaded. If you enable recovery, the server stores only an encrypted recovery envelope and a one-way verifier. |
| Sync metadata | Yes | For each record: identifier, version number, timestamps, deletion state, folder assignment, favorite flag and encrypted size. |
| Usage analytics / telemetry | No | No analytics SDKs integrated (no Sentry / Firebase / GA / Mixpanel). |
| Crash reports | No | No automatic crash uploads. |
| Client IP | Transient | Kept only in web access logs as operationally needed; not written to the user database. |
| Favicons | See below | The host name of a login's saved website is sent only to that website, never to a third-party icon service. No username, password, note, or other vault field is sent. You can turn this off in Settings. |
| Password breach check | See below | Only when you run the check, the first five characters of each password's SHA-1 hash are sent to Have I Been Pwned's range API. Plaintext passwords and full hashes are not sent. |
We never upload your master password or any derived key, plaintext vault content, or your browser history, clipboard, or filenames.
Cloud sync starts only after you choose to activate a trial or subscribe under Settings → Account & Subscription in the UniPass app; existing Beta accounts keep their cloud access.
The browser extension
The UniPass browser extension for Microsoft Edge and other supported Chromium-based browsers is a companion to the desktop app. It detects login forms, fills credentials in response to user actions, and handles submitted login values only to offer a local save or update prompt. Credentials travel only between the extension and the local desktop app through your operating system's Native Messaging channel — never over the network to us. The extension contains no analytics and sends no browsing data anywhere.
Third-party services
- Favicon fetching (macOS and iOS/iPadOS apps; turn off website icons in Settings): when a login has a public website and no icon cached on this device within the last 7 days, UniPass requests
https://<host>/favicon.icodirectly from that website, thenhttps://<host>/apple-touch-icon.pngif that fails. Private-network addresses, IP addresses and localhost are never requested. The website therefore receives the icon request and your network IP, but no username, password, note, or other vault field. Versions 0.2.43 and earlier fell back to Google's Favicon service; 0.2.45 removed that fallback. - Have I Been Pwned password range API: only after you choose to run a breach check, UniPass hashes passwords locally and sends the first five hexadecimal characters of each SHA-1 hash with response padding enabled. The plaintext password and remaining hash characters never leave the device. Have I Been Pwned receives the prefix and your network IP.
- UniPass server: operated by the UniPass team and reached over HTTPS + WebSocket. It handles account sign-in and, when cloud sync is active, exchanges only ciphertext and sync metadata.
UniPass does not use third-party advertising or analytics services.
Local diagnostics
Mac can export a local support bundle; iOS can preview and copy a local support summary. Neither is uploaded automatically. Summaries include allowed fields such as app/system version, error category and sync/purchase status, excluding passwords, Secret Keys, vault fields and raw transaction payloads. Preview the output before choosing to share it.
Where data is stored
All local data lives in the standard OS user-data directory:
- macOS:
~/Library/Application Support/io.loxnet.unipass/ - iOS/iPadOS: the app sandbox and shared App Group container used by the app and AutoFill; keys are protected in the system Keychain.
- Exported backups: the location you select; removing a local account or app does not remove these independent backups.
The database is encrypted with SQLCipher using a key derived from your master password. OS file permissions (0600) prevent other users from reading it.
Data deletion
- A single record: moved to Trash, permanently deleted after 30 days, or removed immediately by you.
- Local account and vault: use the in-app removal flow after checking pending changes, conflicts and backups. Moving the Mac app to Trash does not delete Application Support or Keychain data; uninstalling on iOS does not guarantee removal of system Keychain credentials. Contact support when you need complete cleanup.
- Server data: revoke a device under Settings → Sync & Devices, or delete your account under Settings → Account & Subscription (cancel a renewing website subscription first; an App Store subscription must be canceled in your Apple Account, because deleting your UniPass account does not cancel it); account deletion removes your account data and the server-side ciphertext and sync metadata. Subscription and payment records are kept for refunds and accounting, as described below. Uninstalling the client does not automatically delete server data.
Children's privacy
UniPass is not directed to children under 13 and does not knowingly collect personal data from minors.
Changes
Revisions to this policy are announced in the project's release notes. Material changes will be communicated to users in advance.
Contact
- Privacy enquiries: business@loxnet.io
- Security disclosure: business@loxnet.io (subject prefix
[SECURITY]; see our Security page)
Operator and billing data processing
UniPass is operated by 上海洛克斯网络科技有限公司. Privacy contact: business@loxnet.io.
Creem (Armitage Labs OÜ, Estonia) processes checkout and payment details as Merchant of Record for Personal purchases through Creem. Creem collects the buyer's name, email, billing address, payment and order details under its Privacy Notice. UniPass receives customer, order and subscription identifiers, plan, payment status and renewal dates needed to link an account, deliver benefits, support customers, handle refunds and maintain billing records. UniPass does not receive full card numbers or card security codes, or send vault contents, master passwords, Secret Keys or recovery codes to the payment provider.
Payment data may be processed outside your country by the seller identified at checkout and its payment partners. Stored billing events omit buyer email, card details, billing addresses and vault contents; identifiers and payment records are retained as needed to manage subscriptions, refunds and accounting obligations. For any transaction processed by Paddle, see Paddle’s privacy policy.
When you purchase through the App Store on iPhone or iPad, Apple processes the payment under the Apple Privacy Policy. UniPass does not receive your Apple Account email, name or payment details. It receives and keeps only Apple-signed transaction information: transaction identifiers, product, purchase and expiry times, price and currency, storefront country or region, renewal and refund status, and the random account token attached to the purchase. UniPass generates that token for each account solely to link the subscription to your UniPass account; it carries nothing that identifies you. These records are kept as needed for subscriptions, refunds and accounting.